Rafael Mendonça França 0f3b7d1a31 Only accept actions without File::SEPARATOR in the name. ...

This will avoid directory traversal in implicit render.

Fixes: CVE-2014-0130

2014-05-05 11:37:34 -03:00

..

railties

Rely on a public contract between railties instead of accessing railtie methods directly.

2011-11-23 19:06:45 +00:00

asset_paths.rb

Default relative_url_root to ENV["RAILS_RELATIVE_URL_ROOT"]. Fixes #3365

2011-12-12 17:11:07 +01:00

base.rb

Only accept actions without File::SEPARATOR in the name.

2014-05-05 11:37:34 -03:00

callbacks.rb

Fix comment in AbstractController callbacks

2011-10-06 10:39:37 +04:00

collector.rb

Add missing require on abstract_controller/collector [#4061 status:resolved]

2010-02-26 10:27:06 +01:00

helpers.rb

Remove extra white spaces on ActionPack docs.

2011-05-23 20:22:33 -03:00

layouts.rb

Shush uninitialized @_layout warning

2012-09-28 10:53:17 -07:00

logger.rb

Fix extend -> include.

2011-12-09 21:42:18 +01:00

rendering.rb

Fix #5440 - multiple render_to_string breaks partials formats

2012-03-17 14:15:50 +01:00

translation.rb

Move ActionController::Translation to AbstractController::Translation.

2010-01-20 15:02:13 +01:00

url_for.rb

minor edits after going through what's new in docrails

2011-05-14 11:15:43 +02:00

view_paths.rb

Optimize layout lookup to avoid double calls.

2011-12-08 16:39:06 +01:00